Comment Comment by eqvinox > aw, shucks, someone proved to be untrustworthy and they're in such a critical role in the ecosystemYou mean until the DNSsec key rollover completes and they're no longer in that role?As opposed to what we have now, an indefinite period where crappy non-updated devices will still accept these certs and nothing can be done about it?The Web PKI works great for browsers. Everything else, not so much.(To be fair, the crappy devices¹ would probably fail to deal with the periodic DNSsec root key rollovers. But at least that's a fail-closed.)¹ a label that includes older versions of systemd-resolved, for whatever that may mean parent eqvinox 20 days ago
You mean until the DNSsec key rollover completes and they're no longer in that role?
As opposed to what we have now, an indefinite period where crappy non-updated devices will still accept these certs and nothing can be done about it?
The Web PKI works great for browsers. Everything else, not so much.
(To be fair, the crappy devices¹ would probably fail to deal with the periodic DNSsec root key rollovers. But at least that's a fail-closed.)
¹ a label that includes older versions of systemd-resolved, for whatever that may mean